Method, apparatus, and system for determining relative importance of computer code analysis alerts

Abstract

A computing apparatus and method adapted to obtain an identification of computer code for analysis; retrieve the computer code based on the identification; generate an abstract program representation of the retrieved computer code; conduct execution behavior analysis of the computer code using the abstract program representation to generate a graphical representation of execution behavior for the computer code; obtain a plurality of alerts generated from one or more static code analysis processes that are performed on the computer code; compute respective alert metrics for the plurality of alerts using the abstract program representation and the graphical representation of execution behavior; rank the plurality of alerts by the computed alert metrics; and output a ranked list of the plurality of alerts.

What is claimed is: 
     
         1 . A computing apparatus, comprising:
 one or more processors; and   a memory having stored therein machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to:   obtain, from a user via a user interface, an identification of computer code for analysis;   retrieve, from a memory storage device, the computer code based on the identification obtained from the user;   generate an abstract program representation of the retrieved computer code;   conduct execution behavior analysis of the computer code using the abstract program representation to generate a graphical representation of execution behavior for the computer code;   obtain a plurality of alerts generated from one or more automated static code analysis processes that are performed on the computer code;   compute respective alert metrics for the plurality of alerts using the abstract program representation and the graphical representation of execution behavior;   rank the plurality of alerts by the computed alert metrics;   output, to the user via the user interface, a ranked list of the plurality of alerts;   resolve at least one of the plurality of alerts based on the ranked list;   recalibrate at least one of the respective alert metrics for remaining one or more of the plurality of alerts;   update the ranked list upon determining that a subset of the ranked list of the plurality of alerts has been resolved; and   output, to the user via the user interface, the updated rank list.   
     
     
         2 . The computing apparatus of  claim 1 , wherein for generating the abstract program representation, the machine-readable instructions, when executed by the one or more processors, cause the one or more processors to:
 convert the retrieved computer code to a stream of source code text;   tokenize the converted text stream into a plurality of tokens;   assign respective context indicators to the tokens; and   generate an abstract syntax tree using the tokens with the assigned context indicators, said abstract syntax tree representing the abstract program representation.   
     
     
         3 . The computing apparatus of  claim 1 , wherein for the execution behavior analysis, the machine-readable instructions, when executed by the one or more processors, cause the one or more processors to:
 determine a control flow of the retrieved computer code using the abstract program representation to generate one or more control flow graphs;   identify one or more data dependencies among a plurality of nodes in the one or more control flow graphs to generate corresponding one or more program dependence graphs; and   generate a code graph representation of a system associated with the retrieved computer code using the one or more program dependence graphs, said code graph representation being used as the graphical representation of execution behavior to compute the respective alert metrics.   
     
     
         4 . The computing apparatus of  claim 3 , wherein the code graph representation is generated using one or more call graphs derived from an abstract syntax tree comprised in the abstract program representation. 
     
     
         5 . A computing apparatus, comprising:
 one or more processors; and   a memory having stored therein machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to:   obtain, from a user via a user interface, an identification of computer code for analysis;   
       retrieve, from a memory storage device, the computer code based on the identification obtained from the user;
 generate an abstract program representation of the retrieved computer code; 
 conduct execution behavior analysis of the computer code using the abstract program representation to generate a graphical representation of execution behavior for the computer code; 
 obtain a plurality of alerts generated from one or more automated static code analysis processes that are performed on the computer code; 
 compute respective alert metrics for the plurality of alerts using the abstract program representation and the graphical representation of execution behavior; 
 rank the plurality of alerts by the computed alert metrics; 
 output, to the user via the user interface, a ranked list of the plurality of alerts; and 
 for computing the respective alert metrics, the machine-readable instructions, when executed by the one or more processors, cause the one or more processors to: 
 compute one or more possible execution paths for each of the plurality of alerts; 
 estimate an execution frequency for each node of the graphical representation of execution behavior; 
 estimate an execution probability for each node of the graphical representation of execution behavior using the computed one or more possible execution paths; 
 locate respective nodes containing the plurality of alerts on the graphical representation of execution behavior; 
 compute a complexity indicator for each of the plurality of alerts using the estimated execution frequencies and the estimated execution probabilities for the respective nodes containing the plurality of alerts on the graphical representation of execution behavior; 
 determine an importance measure for each of the respective nodes containing the plurality of alerts; 
 count a number of other alerts on each execution path for the plurality of alerts; 
 assign an alert type score to each of the plurality of alerts; and 
 compute the respective alert metrics by combining the estimated execution frequencies, the estimated execution probabilities, the complexity indicators, the importance measures, the count numbers of other alerts, and the alert type scores for the plurality of alerts. 
 
     
     
         6 . The computing apparatus of  claim 5 , wherein for determining the importance measure for each of the respective nodes containing the plurality of alerts, the machine-readable instructions, when executed by the one or more processors, cause the one or more processors to:
 proceed, starting with a fractional share rank and a null rank and in an iterative or recursive manner, to:
 equally share an old rank of each of the respective nodes containing the plurality of alerts with every linked node of the respective node, and 
 add a supplemental share rank to every node, for a next iteration until relative ranks among the respective nodes containing the plurality of alerts and the linked nodes are unchanged between iterations; and 
   output normalized ranks for the respective nodes containing the plurality alerts for the importance measure.   
     
     
         7 . The computing apparatus of  claim 5 , wherein for assigning the alert type score to each of the plurality of alerts, the machine-readable instructions, when executed by the one or more processors, cause the one or more processors to:
 determine a security measure, a quality measure, and an accuracy measure related to the one or more static code analysis processes from which the plurality of alerts are obtained; and   generate the alert type score by combining the security measure, the quality measure, and the accuracy measure for each of the plurality of alerts.   
     
     
         8 . The computing apparatus of  claim 5 , wherein for computing the one or more possible execution paths for each of the plurality of alerts, the machine-readable instructions, when executed by the one or more processors, cause the one or more processors to:
 generate a backwards slice for each of the plurality of alerts;   enumerate the generated slices according to locations of the plurality of alerts and a parameter that identifies at least one node with an influence on a value of the parameter at each of the locations; and   output the one or more possible execution paths in an ordered list of one or more nodes for each of the plurality of alerts.   
     
     
         9 . A method, comprising:
 obtaining, from a user via a user interface by a computing apparatus configured by executing machine-readable instructions, an identification of computer code for analysis;   retrieving, from a memory storage device by the computing apparatus, the computer code based on the identification obtained from the user;   generating, by the computing apparatus, an abstract program representation of the retrieved computer code;   conducting, by the computing apparatus, execution behavior analysis of the computer code using the abstract program representation to generate a graphical representation of execution behavior for the computer code;   obtaining, by the computing apparatus, a plurality of alerts generated from one or more automated static code analysis processes that are performed on the computer code;   computing, by the computing apparatus, respective alert metrics for the plurality of alerts using the abstract program representation and the graphical representation of execution behavior;   ranking, by the computing apparatus, the plurality of alerts by the computed alert metrics; and   outputting, to the user via the user interface by the computing apparatus, a ranked list of the plurality of alerts;   resolving, by the computing apparatus, at least one of the plurality of alerts based on the ranked list;   recalibrating, by the computing apparatus, at least one of the respective alert metrics for remaining one or more of the plurality of alerts;   updating, by the computing apparatus, the ranked list upon determining that a subset of the ranked list of the plurality of alerts has been resolved; and   outputting, to the user via the user interface by the computing apparatus, the updated rank list.   
     
     
         10 . The method of  claim 9 , further comprising, for generating the abstract program representation:
 converting, by the computing apparatus, the retrieved computer code to a stream of source code text;   tokenizing, by the computing apparatus, the converted text stream into a plurality of tokens;   assigning, by the computing apparatus, respective context indicators to the tokens; and   generating, by the computing apparatus, an abstract syntax tree using the tokens with the assigned context indicators, said abstract syntax tree representing the abstract program representation.   
     
     
         11 . The method of  claim 9 , further comprising, for the execution behavior analysis:
 determining, by the computing apparatus, a control flow of the retrieved computer code using the abstract program representation to generate one or more control flow graphs;   identifying, by the computing apparatus, one or more data dependencies among a plurality of nodes in the one or more control flow graphs to generate corresponding one or more program dependence graphs; and   generating, by the computing apparatus, a code graph representation of a system associated with the retrieved computer code using the one or more program dependence graphs, said code graph representation being used as the graphical representation of execution behavior to compute the respective alert metrics.   
     
     
         12 . The method of  claim 11 , wherein the code graph representation is generated using one or more call graphs derived from an abstract syntax tree comprised in the abstract program representation. 
     
     
         13 . A method, comprising:
 obtaining, from a user via a user interface by a computing apparatus configured by executing machine-readable instructions, an identification of computer code for analysis;   retrieving, from a memory storage device by the computing apparatus, the computer code based on the identification obtained from the user;   generating, by the computing apparatus, an abstract program representation of the retrieved computer code;   conducting, by the computing apparatus, execution behavior analysis of the computer code using the abstract program representation to generate a graphical representation of execution behavior for the computer code;   obtaining, by the computing apparatus, a plurality of alerts generated from one or more automated static code analysis processes that are performed on the computer code;   computing, by the computing apparatus, respective alert metrics for the plurality of alerts using the abstract program representation and the graphical representation of execution behavior;   ranking, by the computing apparatus, the plurality of alerts by the computed alert metrics; and   outputting, to the user via the user interface by the computing apparatus, a ranked list of the plurality of alerts; and   for computing the respective alert metrics:   computing, by the computing apparatus, one or more possible execution paths for each of the plurality of alerts;   estimating, by the computing apparatus, an execution frequency for each node of the graphical representation of execution behavior;   estimating, by the computing apparatus, an execution probability for each node of the graphical representation of execution behavior using the computed one or more possible execution paths;   locating, by the computing apparatus, respective nodes containing the plurality of alerts on the graphical representation of execution behavior;   computing, by the computing apparatus, a complexity indicator for each of the plurality of alerts using the estimated execution frequencies and the estimated execution probabilities for the respective nodes containing the plurality of alerts on the graphical representation of execution behavior;   determining, by the computing apparatus, an importance measure for each of the respective nodes containing the plurality of alerts;   counting, by the computing apparatus, a number of other alerts on each execution path for the plurality of alerts;   assigning, by the computing apparatus, an alert type score to each of the plurality of alerts; and   computing, by the computing apparatus, the respective alert metrics by combining the estimated execution frequencies, the estimated execution probabilities, the complexity indicators, the importance measures, the count numbers of other alerts, and the alert type scores for the plurality of alerts.   
     
     
         14 . The method of  claim 13 , further comprising, for determining the importance measure for each of the respective nodes containing the plurality of alerts:
 proceeding, by the computing apparatus, starting with a fractional share rank and a null rank and in an iterative or recursive manner, to:
 equally share an old rank of each of the respective nodes containing the plurality of alerts with every linked node of the respective node, and 
 add a supplemental share rank to every node, for a next iteration until relative ranks among the respective nodes containing the plurality of alerts and the linked nodes are unchanged between iterations; and 
   outputting, by the computing apparatus, normalized ranks for the respective nodes containing the plurality alerts for the importance measure.   
     
     
         15 . The method of  claim 13 , further comprising, for assigning the alert type score to each of the plurality of alerts:
 determining, by the computing apparatus, a security measure, a quality measure, and an accuracy measure related to the one or more static code analysis processes from which the plurality of alerts are obtained; and   generating, by the computing apparatus, the alert type score by combining the security measure, the quality measure, and the accuracy measure for each of the plurality of alerts.   
     
     
         16 . The method of  claim 13 , further comprising, for computing the one or more possible execution paths for each of the plurality of alerts,
 generating, by the computing apparatus, a backwards slice for each of the plurality of alerts;   enumerating, by the computing apparatus, the generated slices according to locations of the plurality of alerts and a parameter that identifies at least one node with an influence on a value of the parameter at each of the locations; and   outputting, by the computing apparatus, the one or more possible execution paths in an ordered list of one or more nodes for each of the plurality of alerts.